A SecureGuard license is a signed grant issued at activation and verified on the appliance against an embedded vendor public key. The appliance only ever verifies — the signing key never ships in an image.
Why licensing is two steps
A license can be bound to one appliance by having its node ID signed into the payload. A bound license activates only on the appliance whose device ID matches, and fails closed on a mismatch: rather than granting entitlements on the wrong box, it reverts to the free Community tier and says which node it was issued for.
That has an unavoidable consequence for how you get one. The key cannot exist before the appliance does, because the appliance's ID is part of what is signed. So:
| Step 1 — request | Step 2 — activate | |
|---|---|---|
| You provide | Email, and company for a paid plan | Activation code + appliance node ID |
| You receive | An activation code, by email | The license key |
| Where | Get a free license for a free plan, checkout for a paid one | This site, the activation page, or the appliance itself |
Nobody is emailed a license key. If you are waiting on one, you are waiting for something that will not arrive — activate your code instead. Step 1 sends a code; the key is minted at step 2.
Activation is idempotent per appliance. Re-submitting the same code and node ID returns the existing key and does not consume another seat, so a double-click cannot cost you one. A multi-seat code can be used again for your next appliance.
What is in the token
The token is a base64url payload and an Ed25519 signature over exactly those payload bytes — deliberately not a JWT. The payload carries the product slug, who it is licensed to, the tier, the issue and expiry dates, an optional node binding, and a feature list.
The product slug matters: a token issued for a different Rubix product is rejected outright, so one product's license can never unlock the firewall. Numeric caps that do not fit the shared cross-product schema — throughput, tunnel and VPN-user counts, the grace floor — travel as key=value entries in that feature list, while plain entries are feature flags.
Tiers and entitlements
Entitlements are derived from the tier, then adjusted by any per-license overrides. Core firewalling, NAT, objects, zones, static routing, local admin login and AI in observe/suggest mode are never gated — the free tier is a complete firewall at small scale, not a demonstration of one. HA clustering is tested and shipping on Business+. Threat feeds ship on Home+. Off-box analysis is coming soon, not a Business entitlement. Fleet management is the free Orchestrator download, not a Business+ license feature.
| Feature | Community | Home | Business | Enterprise |
|---|---|---|---|---|
| Site-to-site tunnels IPSec, WireGuard and SiteLink combined | 1 | 5 | 25 | Unlimited |
| Remote-access VPN users | 10 | 50 | Unlimited | Unlimited |
| Firewall, NAT, objects, zones, static routing Never gated — a free appliance is a complete firewall | ✓ | ✓ | ✓ | ✓ |
| Flood and reconnaissance protection | ✓ | ✓ | ✓ | ✓ |
| AI security: observe and suggest | ✓ | ✓ | ✓ | ✓ |
| Preview, commit, rollback, live logs | ✓ | ✓ | ✓ | ✓ |
| Priority updates and threat feeds Shipping on Home+ | — | ✓ | ✓ | ✓ |
| External authentication RADIUS, LDAP, Active Directory, SSO | — | — | ✓ | ✓ |
| Dynamic routing (OSPF, BGP) | — | — | ✓ | ✓ |
| Active/passive HA cluster Shipping on Business+ — tested | — | — | ✓ | ✓ |
Throughput is unlimited and unthrottled by default on every tier; a license may carry an explicit cap. Community is perpetual and never throttled.
What the commit gate refuses
Entitlements are enforced at commit time, not by disabling screens. When a commit would turn on a paid feature or grow past a cap, it is rejected with an upgrade prompt naming the tier or feature that would allow it.
Crucially, the gate compares the config you are committing against the one currently running, so already-enabled features and existing scale are grandfathered. It blocks newly enabling something, and never rips out config that is already carrying traffic. Losing connectivity is not an acceptable license-enforcement mechanism.
What expiry does
When a paid license lapses the appliance keeps passing packets. It degrades instead:
- Throughput is limited to a grace floor — 10 Mbps unless the license sets another.
- Tunnel and VPN-user scale revert to Community limits.
- Gated features stop being enableable; what is already running keeps running.
- The console states exactly what happened and what renewing restores, rather than showing a generic "unlicensed" state.
Any inconsistency — an unverifiable signature, a malformed expiry date, a mismatched product, a node binding for a different box — fails safe to Community with a message explaining which check failed. The appliance never becomes unusable because a license file is wrong.
Where your licenses live
Codes, licenses and images are all in your account. This website captures the request and forwards it, and the appliance only verifies what it is given. Nothing about your entitlement depends on this site being reachable, and nothing about passing traffic depends on an account page being reachable.